Proof Key for Code Exchange (RFC 7636) is an extension to the OAuth2 authorization code flow designed to prevent authorization code interception attacks on public clients.

Does this tool send my code verifier to a server?

No, all generation, hashing, and validation operations run entirely client-side in your browser using the Web Crypto API.

What are the RFC 7636 requirements for a code verifier?

It must be a high-entropy cryptographic string between 43 and 128 characters long, containing only unreserved characters: letters, numbers, hyphens, periods, underscores, and tildes.

What is the difference between code_challenge and code_verifier?

The code_verifier is a secret random string kept on the client, while the code_challenge is the BASE64URL-encoded SHA256 hash of that verifier sent to the authorization server.

Why am I getting an 'invalid_grant' error during token exchange?

This usually happens because the code_verifier sent during the token exchange does not hash to the code_challenge sent during the initial authorization request.

Elysia Tools

Navigation

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Details

What this tool helps you do

A focused PKCE (Proof Key for Code Exchange, RFC 7636) tool for OAuth2 / OIDC developers:

Pick a mode: Generate (a fresh pair), Validate (audit a verifier you have), or Verify (check a verifier/challenge pair match).
Generate mode derives a codeverifier from cryptographically secure random bytes (choose 32/48/64/96 bytes = 256/384/512/768 bits) and base64url-encodes it, then computes codechallenge = BASE64URL(SHA256(verifier)). The verifier stays client-side; only the challenge goes to the authorization server.
Validate mode audits an existing verifier against RFC 7636: length 43–128 characters, charset restricted to [A-Za-z0-9-._~], and ≥256 bits of entropy. If compliant it also shows the S256 challenge the verifier implies.
Verify mode recomputes BASE64URL(SHA256(verifier)) and compares it to a provided codechallenge — useful when debugging "invalidgrant" or mismatched challenge errors during the token exchange.
Optionally fill in the authorization endpoint, client ID and redirect URI to build the full authorization-request URL (with codechallengemethod=S256) and the token-exchange body that later sends the secret verifier.

Offline and cryptographically sound: random bytes come from the platform CSPRNG; SHA256 via the crypto module. No network calls, no value leaves the browser.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Prepared example runs

Click an example to fill the form automatically. File inputs still need an upload.

2 examples

Generate a 512-bit PKCE pair

A fresh code_verifier (64 random bytes → base64url) and its S256 code_challenge, ready to wire into an SPA authorization request. The audit confirms RFC 7636 compliance.

<div class="pk-wrap">…verifier (86 chars) + challenge (43 chars), method S256, 512 bits entropy, audit all-green (length 43–128, charset OK, ≥256 bits)…</div>

Validate an existing verifier

Audit a verifier copied out of a client log: is it within 43–128 chars, only allowed charset, and at least 256 bits of entropy? On success, also show the challenge it implies.

<div class="pk-wrap">…the RFC 7636 sample verifier passes all checks (43 chars, charset OK, ≥256 bits); its implied S256 challenge is E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM…</div>

Inputs

Set the required fields, then run the tool.

7 options

ContentPaste or type the main input values.5

Existing code_verifier (to validate/verify)textareaOptionalExisting code_challenge (pair-verify mode)textareaOptionalAuthorization endpoint (optional, for URL builder)textOptionalClient ID (optional, for URL builder)textOptionalRedirect URI (optional, for URL builder)textOptional

SettingsAdjust formats, ranges, numbers, and modes.2

ModeselectOptionalVerifier length (bytes of entropy)selectOptional

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

PKCE Code Verifier & Challenge Generator

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Generate a Secure 512-bit PKCE Pair for a Single-Page App

2. Verify a Mismatched PKCE Pair from Server Logs

FAQ

QR Code Samples

Code Comment Samples

Web Image Processing Python Samples

Invalid Variable Names Code Samples

Hash Algorithm Comparator

BIP39 Mnemonic Phrase Generator

RSA Encrypt / Decrypt

SSH Key Pair Generator

Audio Encoding and Format Conversion Tools

Image Format Conversion and Animated Export Tools

JSON Interchange and Format Translation Tools

Color Space Conversion Tools for Web and Print